Verify ACP relay events before prompt routing

[jmecom]

What changed

Verify every Nostr EVENT received by buzz-acp immediately after deserialization. Events with an invalid NIP-01 ID or Schnorr signature are dropped before subscription routing, deduplication, replay-watermark updates, membership handling, or either harness queue.

Safety

Signature verification runs on the blocking pool so cryptographic work does not block the relay task. A verification failure drops only that event and keeps the connection available for subsequent valid traffic. The existing observer-control verification remains as defense in depth.

Regression tests cover valid delivery; changed content, ID, signature, pubkey, tags, and timestamp; a forged owner shutdown command with a recomputed ID; forged membership notifications; and forged observer-control events.

Testing

cargo test -p buzz-acp

cargo clippy -p buzz-acp --all-targets -- -D warnings

just ci

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 2c99ee7af5a20d239e95ec5368407887449795c9...0a05ea3e86a5cde4ffd56ee08a4f6a95ec40bc59.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 0a05ea3e86a5cde4ffd56ee08a4f6a95ec40bc59 to authorize a new review.
Any previous review applies only to its recorded range.